Privacy Policy

1. Introduction

Obteno ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share your personal data when you use our platform.

2. Data We Collect

We collect the following information:

• Account information: email address, name, and password (hashed)
• Payment information: processed securely by Stripe — we do not store card details
• Usage data: features used, credits consumed, content generated, and session activity
• Device data: browser type, IP address, and device identifiers for security purposes
• Where you came from: if you register for our free challenge from an advert or a link carrying campaign tags (such as utm_source or utm_campaign), we keep those tags in your browser tab until you sign up, then save them against your email address in our email provider, Loops, so we can see which advert brought you in. We do not save Meta's click ID with these tags; see section 9 for what we send to Meta if you accept marketing cookies.

3. How We Use Your Data

• To provide and maintain the Platform and its features
• To process payments and manage your subscription
• To send transactional emails (welcome, onboarding, billing)
• To improve the Platform based on usage patterns
• To detect and prevent fraud and account abuse

4. Third-Party Processors

We use the following third-party services to operate the Platform. Each of them may process personal data on our behalf:

• Supabase — database, authentication, and file storage (holds your account and all content you create)
• Vercel — website hosting (processes IP address and browser information for all visitors)
• Stripe — payment processing and subscription management
• Google (Gemini) — AI generation. Content you supply to the AI tools is sent to Google, including anything you enter in your creator profile (such as your "about me" text and writing samples) and any audio or video you upload for transcription
• Loops and Resend — transactional and marketing email delivery, and contact management
• Meta (Facebook) — advertising measurement (see section 9)
• Microsoft Clarity — analytics and session replay (see section 9)
• Google Analytics — website analytics (see section 9)
• Google — sign-in with Google, and Google Fonts
• Cloudflare Stream and Cloudinary — video hosting and delivery for course lessons
• Anthropic — only if you choose to connect Obteno to Claude, in which case your product content is shared with Claude to fulfil your requests
• Notion, Unsplash and DataForSEO — template delivery, stock imagery, and keyword data

We also operate our own document-rendering server, which processes the content of products you generate in order to produce your downloadable files.

5. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it by law (e.g., billing records).

6. Your Rights

Under GDPR and CCPA, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing of your data
• Request data portability
• Withdraw consent at any time

You can request deletion of your account from Settings → Danger Zone inside the app. We cancel any active subscription immediately so you are not billed again, and remove your personal data within 30 days.

To exercise any other right, contact us at issac@obteno.com.

7. Data We Process on Behalf of Creators (Obteno Track and Interactive Editions)

Some products built on Obteno (for example, Challenge Kits) can include an optional guided tracker. When a creator's end-customer chooses to use it, they provide a first name and email and may add daily reflections. For this feature, Obteno acts as a data processor on behalf of the creator (who is the data controller): we store this information solely to operate the tracker, we never sell it, and we never use it for our own advertising.

To delete all of your tracker data, email issac@obteno.com and we will remove it within 30 days.

Interactive Editions. A creator can turn a product into an Interactive Edition that their buyers open on their phone, with no Obteno account. When a buyer opens one, we store for the creator the answers they type in, when they last opened it, and a reference that lets us check with the shop (Gumroad or Whop) that their purchase is still valid: a one-way scramble of their access code, or an anonymous Whop ID. We do not store the buyer's name or email. Obteno acts as a data processor for the creator. We keep the answers until the creator deletes them, the buyer asks (email issac@obteno.com), or the creator closes their Obteno account. To stop code-guessing we also keep a short-lived counter of attempts per internet address.

8. The Member Community

If you post in the member community we store the display name you choose, the posts and replies you write, any reports you file, the members you block, and the outcome of the automated moderation check on each post.

What other members can see: your display name and what you write. Your email address, your subscription status and your billing details are never shown to other members. You choose your display name yourself and it does not have to be your real name.

Automated moderation. Before a post becomes visible to anyone else, its text is sent to Google (Gemini) to be screened for abuse, scams and illegal content, and the resulting decision is stored with the post. This is automated processing, and where it refuses a post you can ask a human to review that decision by emailing issac@obteno.com. Google is already listed as a processor in section 4.

Reports are confidential. If you report a post, the member you reported is not told who reported them.

Retention. You can delete your own posts at any time. If you close your account, your display name is deleted and your posts are re-attributed to "Former member" so that conversations other members took part in remain intelligible; you may instead ask for your posts to be deleted outright by emailing issac@obteno.com. Deleted and removed posts are kept internally for a limited period as the record behind a moderation decision, and are then destroyed.

Age. Posting in the community requires you to be 18 or over, which is stricter than the age limit for the Platform as a whole in section 10.

9. Cookies & Tracking Technologies

We use essential cookies and similar storage for authentication and session management. These are required for the Platform to work and are always active.

We also use non-essential analytics and advertising technologies. These only load if you accept them in the cookie banner shown on your first visit. If you reject, or have not yet chosen, none of them run. The non-essential technologies are:

• Meta (Facebook) Pixel — measures the effectiveness of our advertising and sets advertising cookies (including _fbp and _fbc). It records page views, button clicks and checkout events. This data goes to Meta Platforms, Inc. and may be used to target advertising on Facebook and Instagram.
• If you accept marketing cookies, then when you sign up or buy, our server also tells Meta (Facebook) about it, with your email address in scrambled (hashed) form, your IP address, your browser type and Meta's cookie IDs, so we can measure how well our adverts work. If you reject them, we send none of this.
• Microsoft Clarity — records how the site is used, including session replay: a reconstruction of your clicks, scrolling and navigation. This data goes to Microsoft.
• Google Analytics 4 — measures traffic and page views. This data goes to Google.

You can change your choice at any time by clearing this site's data in your browser, which will show the banner again. You can additionally opt out of interest-based advertising through your Facebook Ad Settings or the Digital Advertising Alliance opt-out page.

10. Children's Privacy

The Platform is not intended for users under the age of 16. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on the Platform.

12. Contact

For questions about this Privacy Policy or your data, contact us at issac@obteno.com.